netdev - Re: [PATCH net,v3] tcp: make sure init the accept

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <a4a29064-e0f5-69b8-b690-911d155fec86@huawei.com>
Date: Wed, 17 Jan 2024 19:52:55 +0800
From: shaozhengchao <shaozhengchao@...wei.com>
To: Eric Dumazet <edumazet@...gle.com>
CC: <netdev@...r.kernel.org>, <davem@...emloft.net>, <kuba@...nel.org>,
	<pabeni@...hat.com>, <dsahern@...nel.org>, <sming56@...yun.com>,
	<weiyongjun1@...wei.com>, <yuehaibing@...wei.com>
Subject: Re: [PATCH net,v3] tcp: make sure init the accept_queue's spinlocks
 once



On 2024/1/17 19:28, Eric Dumazet wrote:
> On Wed, Jan 17, 2024 at 7:22 AM Zhengchao Shao <shaozhengchao@...wei.com> wrote:
>>
>> When I run syz's reproduction C program locally, it causes the following
>> </TASK>
>>
>> The issue triggering process is analyzed as follows:
>> Thread A                                       Thread B
>> tcp_v4_rcv      //receive ack TCP packet       inet_shutdown
>>    tcp_check_req                                  tcp_disconnect //disconnect sock
>>    ...                                              tcp_set_state(sk, TCP_CLOSE)
>>      inet_csk_complete_hashdance                ...
>>        inet_csk_reqsk_queue_add                 inet_listen  //start listen
>>          spin_lock(&queue->rskq_lock)             inet_csk_listen_start
>>          ...                                        reqsk_queue_alloc
>>          ...                                          spin_lock_init
>>          spin_unlock(&queue->rskq_lock)  //warning
>>
>> When the socket receives the ACK packet during the three-way handshake,
>> it will hold spinlock. And then the user actively shutdowns the socket
>> and listens to the socket immediately, the spinlock will be initialized.
>> When the socket is going to release the spinlock, a warning is generated.
>> Also the same issue to fastopenq.lock.
>>
>> Move init spinlock to inet_create and inet_accept to make sure init the
>> accept_queue's spinlocks once.
>>
>> Fixes: fff1f3001cc5 ("tcp: add a spinlock to protect struct request_sock_queue")
>> Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path")
>> Reported-by: Ming Shu <sming56@...yun.com>
>> Signed-off-by: Zhengchao Shao <shaozhengchao@...wei.com>
>> ---
>> v3: Move init spinlock to inet_create and inet_accept.
>> v2: Add 'init_done' to make sure init the accept_queue's spinlocks once.
>> ---
>>   net/core/request_sock.c         |  3 ---
>>   net/ipv4/af_inet.c              | 11 +++++++++++
>>   net/ipv4/inet_connection_sock.c |  8 ++++++++
>>   3 files changed, 19 insertions(+), 3 deletions(-)
>>
>> diff --git a/net/core/request_sock.c b/net/core/request_sock.c
>> index f35c2e998406..63de5c635842 100644
>> --- a/net/core/request_sock.c
>> +++ b/net/core/request_sock.c
>> @@ -33,9 +33,6 @@
>>
>>   void reqsk_queue_alloc(struct request_sock_queue *queue)
>>   {
>> -       spin_lock_init(&queue->rskq_lock);
>> -
>> -       spin_lock_init(&queue->fastopenq.lock);
>>          queue->fastopenq.rskq_rst_head = NULL;
>>          queue->fastopenq.rskq_rst_tail = NULL;
>>          queue->fastopenq.qlen = 0;
>> diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
>> index 835f4f9d98d2..6589741157a4 100644
>> --- a/net/ipv4/af_inet.c
>> +++ b/net/ipv4/af_inet.c
>> @@ -244,6 +244,14 @@ int inet_listen(struct socket *sock, int backlog)
>>   }
>>   EXPORT_SYMBOL(inet_listen);
>>
>> +static void __inet_init_csk_lock(struct sock *sk)
>> +{
>> +       struct inet_connection_sock *icsk = inet_csk(sk);
>> +
>> +       spin_lock_init(&icsk->icsk_accept_queue.rskq_lock);
>> +       spin_lock_init(&icsk->icsk_accept_queue.fastopenq.lock);
>> +}
> 
> This probably could be an inline helper in a suitable include file.
> No need for __prefix btw.
> 
> static void inline inet_init_csk_locks(struct sock *sk)
> {
>         struct inet_connection_sock *icsk = inet_csk(sk);
> 
>         spin_lock_init(&icsk->icsk_accept_queue.rskq_lock);
>         spin_lock_init(&icsk->icsk_accept_queue.fastopenq.lock);
> }
> 
> 
>> +
>>   /*
>>    *     Create an inet socket.
>>    */
>> @@ -330,6 +338,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
>>          if (INET_PROTOSW_REUSE & answer_flags)
>>                  sk->sk_reuse = SK_CAN_REUSE;
>>
>> +       if (INET_PROTOSW_ICSK & answer_flags)
>> +               __inet_init_csk_lock(sk);
>> +
>>          inet = inet_sk(sk);
>>          inet_assign_bit(IS_ICSK, sk, INET_PROTOSW_ICSK & answer_flags);
>>
>> diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
>> index 8e2eb1793685..5d3277ab9954 100644
>> --- a/net/ipv4/inet_connection_sock.c
>> +++ b/net/ipv4/inet_connection_sock.c
>> @@ -655,6 +655,7 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern)
>>   {
>>          struct inet_connection_sock *icsk = inet_csk(sk);
>>          struct request_sock_queue *queue = &icsk->icsk_accept_queue;
>> +       struct request_sock_queue *newqueue;
>>          struct request_sock *req;
>>          struct sock *newsk;
>>          int error;
>> @@ -727,6 +728,13 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern)
>>          }
>>          if (req)
>>                  reqsk_put(req);
>> +
>> +       if (newsk) {
>> +               newqueue = &inet_csk(newsk)->icsk_accept_queue;
>> +               spin_lock_init(&newqueue->rskq_lock);
>> +               spin_lock_init(&newqueue->fastopenq.lock);
>> +       }
> 
> So that we could here use a common helper
> 
> if (newsk)
>       inet_init_csk_locks(newsk);
> 
> 
> Thanks, this is looking quite nice.
> 
Hi Eric:
	Thank you for your review. I will send V4 later.

Zhengchao Shao